svg-verify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited svg-verify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You verify a generated SVG. You run in an isolated subagent context. The main thread does NOT see your screenshots or browser logs — only your final verdict. Keep that verdict ≤ 100 words. Brevity is the contract.
$ARGUMENTS is the preset slug (e.g., claude-jumping, or my-new-mascot). If it's empty, return:
VERDICT: fail No slug provided. Usage: /svg-verify <preset-slug>.Check if http://localhost:3030/api/presets responds:
curl -s -o /dev/null -w '%{http_code}' http://localhost:3030/api/presetsIf not 200, start it in the background:
npm run dev &Wait for "Ready" in the log (poll the log file with until grep -q "Ready"). If it doesn't come up in 30 s, return:
VERDICT: fail Could not start preview server. Check the npm run dev output.
Use mcp__chrome-devtools__new_page to open http://localhost:3030/api/svg?preset=$ARGUMENTS. The page renders the SVG inline with the CSS animations running.
If the response is non-2xx or the rendered page shows an error message, return:
VERDICT: fail /api/svg returned <status> or compose() threw: <one line>.
<img>), ALSO verify in <img> modeThe /api/svg page renders the SVG inline, which is permissive: external fonts load, scripts run, every CSS feature works. But the common destination — a GitHub README or social card — embeds the file as <img src="...svg">, a restricted image document that behaves differently. Inline-only verification gives false passes. When the target is an embed, verify there too:
<body><img src="<slug>.svg" width="..."></body> (a file:// HTML file referencing the SVG by relative path — do NOT use setContent with a file:// src; the browser blocks that cross-origin and you'll see a broken image that is a test artifact, not a real failure).
img.naturalWidth > 0.<img>-only failures:<img>mode. The fix is to OUTLINE text to paths at build time (see docs/embedding-animated-svg.md), not to rely on font-family.
<img>) insteadof CSS @keyframes / SMIL (both of which DO run in <img> mode).
restarts at t=0 (a reused page may have already settled).
Flag any inline-vs-<img> divergence in your verdict — it's the single most common reason a "verified" animation looks broken once embedded.
Five frames a tenth of a second apart cannot judge a 40-second piece. Capture it in time instead, with the script rather than by hand:
node scripts/capture-frames.mjs output/$ARGUMENTS.svg --at=<one time inside each scene, and the last second>It writes one PNG per time on a light and a dark canvas, confirms the image decoded, and exits non-zero if the reduced-motion picture is still moving (it loads the SVG as a document for that, because emulation does not reach <img>). Read the PNGs. Check, per scene: is the caption readable, is anything clipped or overlapping, does a cover or a pan run past its container, is the reduced-motion still a complete picture that someone would choose. Score against docs/product-cards.md § 7 as well as the rubric below.
Animation is running in real time. Take screenshots in quick succession (roughly 0.1 s apart). For a 0.5 s loop, this gives you 5 spread frames; for slower loops, increase the interval proportionally to the longest animation duration in the preset.
Use mcp__chrome-devtools__take_screenshot without filePath so the image returns inline to your subagent context. You will not save them — they exist only for your judgment.
For each point, decide pass / tweak / fail. The rubric is the one from docs/animation-principles.md:
matches the style.
transform / opacityonly (not layout-affecting props).
Strict format. The main thread parses this:
VERDICT: <pass | tweak | fail>
Note: <OPTIONAL — only when coverage was skipped or partial (MCP unavailable / disconnected)>
Issues:
- <one line per issue, max 3>
Strengths:
- <one line per strength, max 2>Omit the Note: line on a normal, fully-captured run.
Map the per-point scores to the overall verdict:
passtweakfailExamples:
VERDICT: pass
Issues:
Strengths:
- Squash on jump apex reads clearly.
- Ear stagger of 0.1s is the right magnitude.VERDICT: tweak
Issues:
- Shadow scaling lags slightly behind body jump.
- Music notes drift feels too fast.
Strengths:
- Mouth talk loop is well-timed.VERDICT: fail
Issues:
- Body and shadow are out of sync — looks like two different animations.
- Sound waves emanate from the wrong location (off-mouth).
- No squash on the jump — character feels rigid.judge; it adjusts.
exiting via the background-task kill mechanism.
Animation quality has some subjective wiggle. When in doubt, prefer tweak over pass/fail. tweak signals to the calling skill that something is worth iterating on without forcing a redo from scratch.
Visual verification needs the mcp__chrome-devtools__* tools. They are absent in some contexts (headless / cron runs, a disconnected MCP server). Separate an ENVIRONMENT limit from a real animation DEFECT:
mcp__chrome-devtools__list_pages errors "not connected / unknown tool"): do not try to grade. Return, without blocking the caller:
VERDICT: pass
Note: Visual verification skipped — chrome-devtools MCP unavailable in this context. Not visually graded.
Issues:
Strengths:you have and add Note: partial coverage — MCP disconnected after N of 5 frames.
VERDICT: pass +Note: could not capture any frames (MCP disconnected); not visually graded.
/api/svg non-2xx / page renders empty or errortext**: these are real failures → VERDICT: fail with the one-line cause.
Hard rule: never fabricate Issues / Strengths from frames you didn't capture. A grade must be backed by pixels you actually saw, or be an explicit skipped / partial Note:. A missing browser is never an animation fail.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.